SSL Validation Fails for New Certificates from Let's Encrypt

I am using PactNet 3.0.0 on windows (developer machine) and linux (jenkins pipeline). Our project just updated the certificate used for our internal pact-broker server because the old one expired on Sept-30. Now if I try to run any of our verification tests, the test fails with SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed. I did a bit of digging and determined that setting the SSL_CERT_FILE environment variable resolves the issue when using a newer version of ruby (e.g. 3.0). But the standalone version of ruby ruby 2.2.2p95 distributed with PactNet 3.0.0 does not appear to use the SSL_CERT_FILE environment variable at all. In fact, when I run the SSl Doctor script, it indicates that the SSL path being used is actually hard coded to C:/Users/Justin/Projects/knap-build/var/knapsack/software/x86-windows/openssl/1.0.1l/ssl/certs/ (which doesn’t exist). The SSL_CERT_FILE and SSL_CERT_DIR environment variables are totally ignored, so setting them has no effect. As of now, there is no work-around for this issue since the problem appears to be caused by the stand-alone ruby version included with PactNet.Windows and PactNet.Linux. I have verified that the latest version of the pact-ruby-standalone does not have the same SSL verification issue. However, I don’t know if simply upgrading to the latest will break PactNet. Any ideas?

BTW - here is the output from doctor.rb (executed using the pact-ruby-standalone included with PactNet 3.0.0) when attempting to access github.com:443 on a windows box (note that I have

$ export SSL_CERT_FILE="D:/projects/certs"
$ ./ruby.bat /d/Projects/ssl-tools/doctor.rb github.com:443

OpenSSL 1.0.1l 15 Jan 2015: C:/Users/Justin/Projects/knap-build/var/knapsack/software/x86-windows/openssl/1.0.1l/ssl
SSL_CERT_DIR=""
SSL_CERT_FILE="D:\\Projects\\MyProject\\Provider\\bin\\Debug\\netcoreapp3.1\\pact-win32\\lib\\ruby\\bin\\..\\lib\\ca-bundle.crt"

HEAD https://github.com:443
OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed

The server presented a certificate that could not be verified:
  subject: /C=US/O=DigiCert, Inc./CN=DigiCert High Assurance TLS Hybrid ECC SHA256 2020 CA1
  issuer: /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
  error code 20: unable to get local issuer certificate

Possible causes:
  `C:/Users/Justin/Projects/knap-build/var/knapsack/software/x86-windows/openssl/1.0.1l/ssl/certs/' is empty

[mefellows]

Please see the latest release (3.0.1) which now has the updated embedded ruby standalone. Release is currently being baked now 🧑‍🍳 but artifacts are on the way.

Note that this won’t fully resolve the issue, you will still need to set env vars temporarily until the upstream problem is fixed: https://github.com/pact-foundation/pact-net/issues/330#issuecomment-933821154

Update: no, that build failed/cancelled itself for some reason. I’ll have to try again tomorrow 🤦‍♂️. Update: re-ran the build, and the rest of the artifacts are now released.

[bethesque]

See https://github.com/pact-foundation/pact-ruby-standalone/issues/69

We’ll be attempting to update the bundled certs in Travelling Ruby. In the meantime, try setting PACT_DISABLE_SSL_VERIFICATION=true or set a custom SSL_CERT_FILE using the certificate chain exported from your broker. https://docs.pact.io/pact_broker/advanced_topics/using-tls/#extracting-a-copy-of-the-certificate-from-a-running-pact-broker